1. Field of the Invention
The invention relates to automatic flight control systems and particularly to a dual channel fail operative computer controlled configuration.
2. Description of the Prior Art
Conventional fail passive automatic flight control systems normally require dual redundant channels with cross channel comparison monitors to shut the system down in the event of a failure in either channel. Conventional fail operative systems normally require a minimum of triply redundant channels with cross channel comparison monitors to detect a failure in one of the channels and to shut down the failed channel. It is a desideratum in the flight control art to retain either the fail passive or fail operative characteristic but to reduce the number of channels required therefor.
Flight control systems are known that utilize a digital computer in each of the channels of the system to process the input sensor data and provide surface control signals to the surface servo mechanisms in accordance therewith. In order to render each such channel fail passive and hence provide a dual channel fail operative system, such prior art automatic flight control systems have incorporated external test signal sources and test programs stored in memory for operating on the test signal to provide a predetermined output in accordance with the result of the test program. The predetermined output is then compared to a reference signal to detect failure. Such test programs utilize all of the instructions of the computer instruction repertoire and are repeated during each iteration of the operative program for the system. In sophisticated computers with large instruction repertoires, considerable time is utilized by the computer to execute the test program during which time the computer is executing operations that are not directly related to the primary function of controlling the aircraft. In addition to the time required to perform the test program, valuable memory space is occupied thereby and additional hardware such as a test signal source, a reference signal source and an associated comparator are required.
In such prior art systems, the operative programs normally comprise thousands or tens of thousands of instruction words where the execution of the program is under control of a program counter. A prior art test program can verify that the computer repertoire is functioning properly but cannot determine whether each instruction of the main flight program is free of malfunctions or whether the program counter can properly sequence through the operative program as well as the test program. Thus, a faulty stage of the program counter that is not utilized during the test program but is utilized during the operative program may not be detected by such a procedure, or a faulty memory bit in any one of the stored instructions of the operative program will not be detected, thereby precipitating a potentially dangerous system failure when the operative program is executed.